Privacy Policy
Last updated: 2026-11-01
Short version
We collect your email address when you register an API key, and standard request metadata needed to run and protect the service. We run no ads, no trackers, no analytics scripts. We never sell data.
Who operates this service
App Pain API is designed and operated by Nianqiang Xu, an independent developer — the single legal entity behind this store, matching the business details registered with our payment provider (Creem). For EU/UK data-protection purposes, this operator is the data controller. Contact: support@hawkmill.com.
What we collect
- Email address — only when you self-register an API key. Used to send a one-time verification code and to identify your key.
- Verification codes — a 6-digit code stored with your email for 30 minutes, then it expires automatically.
- Request metadata — our hosting provider (Cloudflare) processes IP addresses, timestamps and requested URLs as part of standard operation, abuse prevention and rate limiting.
- Usage counters — monthly usage counted against your API key (no content), retained about 35 days.
- Referral attribution (optional) — if you sign up through a referral link, we store a one-way hash of your email address and a hash of your IP address alongside the referral, solely to link the referral and prevent reward abuse. Your plain-text email is never shared with the person who referred you.
What we do NOT collect
- No accounts or passwords — an API key and an email is all you have with us.
- No card details. Paid subscriptions are processed by our payment provider Creem (creem.io, merchant of record); card data goes only to them. We receive your order email and subscription status to provision your license key — nothing more.
- No tracking cookies, pixels, or third-party analytics. The site loads a Google Fonts stylesheet; Google may process that request like any font fetch. Nothing about you is shared with them by us.
- No behavioral profiling.
Third-party processors
- Cloudflare — hosting, caching (KV), logs, rate limiting.
- Zhipu AI (open.bigmodel.cn) — for pain-point clustering we send excerpts of public app-store review text. No email addresses, keys, or identifiers of our users are sent.
- Resend — delivers the one-time verification email to your address.
- Creem (creem.io) — merchant of record for paid subscriptions: checkout, payment processing, invoices, refunds. Card details are entered and stored on Creem's side; we only receive your email and subscription status.
- Apple / Google public endpoints — the data sources we read on your behalf.
Data retention
- Verification codes: 30 minutes.
- Cached app data (reviews, metadata, analyses): 6 hours to 7 days, then automatic expiry.
- API key records: until revoked; revocation is soft (record kept for audit, key immediately inactive).
- Usage counters: ~35 days.
- Referral records (hashes and counters only): kept while the referral program is active or until the related key is revoked.
- Platform logs: per Cloudflare's retention policy.
Your rights and choices
Email support@hawkmill.com to have your key revoked and your email record deleted. Deletion removes the key record and pending data; cached analyses of public reviews are not personal data and expire on their own schedule. If you are in the EU/UK, this serves as our lawful-basis statement: legitimate interest in operating a public API service; you may object at any time via the same address.
Changes
If this policy materially changes we will update the date above. Continued use after changes means acceptance.